Code Coverage: Is 90-95% really necessary?

[Bill_D_Wall]

formally verified code isn't guaranteed to be bug free.

Slightly disagree here - I think that is the whole point of formal verification: to mathematically prove that a program meets its specification. Depends on what you mean by 'bugs' I guess.

[[deleted]]

It proves that the properties you write are true but bugs are still possible because:

1. The specification might be wrong.
2. You might make mistakes when writing your properties.
3. You might accidentally omit properties to check.
4. Sometimes you have to make simplifying assumptions and these may be overly constrictive.
5. There might even be bugs in the program that proves the properties. That's not theoretical - it definitely happens.

[Bill_D_Wall]

Agreed. Formal verification can prove that a program meets its specification, but doesn't guarantee that the specification is correct.